The purpose of this memorandum is to provide a brief overview of what was found during the security audit and to offer suggestions of what should be included in the Meridian Manufacturing Ltd. security policy over local area networks.
A local area network, is a network of personal computers that located in a small geographic area such as office, building, or campus. The Computer Security Act of 1987 assigned the responsibility for developing computer standards and guidance for federal unclassified systems including LANs/WANs.
I observed that the file servers that support all LANs sit on a long desk outside mainframe computer room. Controlling access to the server is a basic LAN security issue because sensitive data can be accessed and stolen. The manager retorted that the security access to the file room is restricted to the IT staff and that the keyboards also password protected. The main concern here is that the file servers do sit on the long tables which could bring physical harm to the networks in case the table breaks. Review ITC policy and procedures for using ITS computer equipment for non-official use and evaluate for reasonableness, enforceability and compliance with laws and regulations. Access security rules to ensure the design and structure of access security by verifying IDs used for production jobs are properly defined and verify that the security database is efficiently and efficiently organized from most general to most specific levels of hierarchy.
One of the local area networks has a gateway to the WAN. The purpose of which is share data and software exchanges to help facilitate they work. The main concern is protection against viruses and malware that may come with email exchange. Evaluate controls established to prevent virus infections and determine compliance. First procedure we have to assess whether Wan devised such as bridges, repeaters, routers and switches are properly protected from logical and physical security viewpoints. Also review protocols used in the WAN network and determine whether they are properly configured.
Maintenance of the local area networks is undertaken under contract by a small firm that specialized in selling and supporting local area networks for companies. The manager comments that she is satisfied with the support, she stated that networks have very little downtime and the person who undertakes maintenance works afterhours so there no disruption to network users and that person periodically makes recommendations about how networks should be configured and expanded. The vendor should document all procedures that he performs, those security and controls procedures should be documented to assure that they are known by all parties and tested periodically to assure they are followed. Based on the discussion with the manager, it appears that controls not in place. Another exposure I noted is that procedures for assuring compliance with software licensing requirements are not in place. It is also evident that disaster recovery plan is not tested nor exist at the company.